QuickTalk 1.2 - Source Code Disclosure

======================================================================= 

# QuickTalk v1.2 (Source code disclosure) Multiple Vulnerabilities 

======================================================================= 

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 

0     _                   __           __       __                     1 

1   /' \            __  /'__`\        /\ \__  /'__`\                   0 

0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1 

1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0 

0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1 

1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0 

0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1 

1                  \ \____/ >> Exploit database separated by exploit   0 

0                   \/___/          type (local, remote, DoS, etc.)    1 

1                                                                      1 

0  [+] Site            : Inj3ct0r.com                                  0 

1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1 

0                                                                      0 

1                    ####################################              1 

0                  I'm indoushka member from Inj3ct0r Team             1 

1                    ####################################              0 

0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 

  

######################################################################## 

# Name: QuickTalk v1.2 (Source code disclosure) Multiple Vulnerabilities 

# Vendor: http://www.qt-cute.org/ 

# Date: 2010-05-27 

# Author : indoushka 

# Thanks to : Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com ! 

# Contact : [email protected] 

# Home : www.arab-blackhat.co.cc

# Bug  : XSS 

# Tested on : windows SP2 Français V.(Pnx2 2.0) 
######################################################################## 
                                                                                                                               
# Dork : powered by QT-cute v1.2      
                                                                 
# Exploit By indoushka 

Vulnerability description:

Looks like the source code for this script is available. 
This check is using pattern matching to determine if server side tags are found in the file. 
In some cases this may generate false positives. 

Affected items:

/quicktalk/bin/config.txt 
/quicktalk/bin/config_mysql.txt 
/quicktalk/bin/config_odbc.txt 
/quicktalk/bin/config_posgres.txt 
/quicktalk/bin/config_sqlserver.txt 
/quicktalk/bin/qtf_class_db.inc 
/quicktalk/bin/qtf_class_forum.inc 
/quicktalk/bin/qtf_class_post.inc 
/quicktalk/bin/qtf_class_topic.inc 
/quicktalk/bin/qtf_class_vip.inc 
/quicktalk/bin/qtf_fn_limitsql.inc 
/quicktalk/bin/qtf_fn_smtp.inc 
/quicktalk/bin/qtf_init.inc 

The impact of this vulnerability
An attacker can gather sensitive information (database connection strings, application logic) by analysing the source code. 
This information can be used to conduct further attacks.

How to fix this vulnerability:

Remove this file from your website or change permissions in order to remove access.
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R * www.alkrsan.net * MR.SoOoFe * ThE g0bL!N
------------------------------------------------------------------------------------------------------------------------